@wtfalch/foundry 0.68.0 → 0.68.2

package/dist/org.d.ts

@@ -502,6 +502,16 @@ export interface BouleApp extends OrgBuiltinApp {
 }
 /** True while the company's Boule runs apps (`org.boule.apps`). */
 export declare const appsOn: (org: Pick<DeclaredOrg, "boule">) => boolean;
+/**
+ * `boule.apps` for a company this is the first time anyone declares (#1041): on, when the caller leaves
+ * `boule` unset entirely. Candor FX's go-live hung on "Getting your company ready for apps" because the
+ * first install waits on a request to turn this on, and that request did not apply
+ * (https://github.com/wtfalch/candorfx/issues/32) -- a brand-new company skips the wait by starting with
+ * apps already on. Only `DeclaredOrgStore.create` calls this, never `update`: an existing company's stored
+ * value (on or off) is read back as it is and is never touched here, so this never overrides a choice
+ * anyone -- a caller or an operator -- already made, explicit `boule.apps: false` included.
+ */
+export declare function withNewOrgAppsDefault(org: DeclaredOrg): DeclaredOrg;
 /**
  * The company's kosmos: its own creative workspace (canvas, libraries, photos, pages) that drives the
  * frontend of its apps. Unlike Boule and Agora, which every company runs, kosmos is set up only when the

package/dist/org.js

@@ -37,6 +37,20 @@ export function normalizeTesters(testers) {
 }
 /** True while the company's Boule runs apps (`org.boule.apps`). */
 export const appsOn = (org) => org.boule?.apps === true;
+/**
+ * `boule.apps` for a company this is the first time anyone declares (#1041): on, when the caller leaves
+ * `boule` unset entirely. Candor FX's go-live hung on "Getting your company ready for apps" because the
+ * first install waits on a request to turn this on, and that request did not apply
+ * (https://github.com/wtfalch/candorfx/issues/32) -- a brand-new company skips the wait by starting with
+ * apps already on. Only `DeclaredOrgStore.create` calls this, never `update`: an existing company's stored
+ * value (on or off) is read back as it is and is never touched here, so this never overrides a choice
+ * anyone -- a caller or an operator -- already made, explicit `boule.apps: false` included.
+ */
+export function withNewOrgAppsDefault(org) {
+    if (org.boule?.apps !== undefined)
+        return org;
+    return { ...org, boule: { ...org.boule, apps: true } };
+}
 /** True while the company's kosmos is turned on (`org.kosmos.enabled`). */
 export const kosmosOn = (org) => org.kosmos?.enabled === true;
 /** The most volumes one entry may declare. */

package/dist/plan/apps-db-route.d.ts

@@ -2,15 +2,17 @@ import { type DeclaredOrg } from '../org.js';
 import type { DraftStep } from './diff.js';
 import type { StepExecutionContext } from './plan-apply.js';
 import { type WorkerAppDatabaseDeps } from './worker-app-database.js';
+import { APPS_DB_ENTRY_KEY } from './worker-app.js';
 /**
- * F4 (#925): the Hyperdrive route to the company's own Postgres server (`<slug>-postgres`, the one the
- * apps admin role lives on). Boule creates a database per app copy on that server (`app_<app>_<copy>`) and
- * the edge it calls makes one Hyperdrive config per database. Hyperdrive reaches a database inside Coolify's
- * Docker network only through the company's Cloudflare tunnel behind an Access service token, so this step
- * makes the route once for the server, not once per database:
+ * F4 (#925): the Hyperdrive route to the company's apps database (`<slug>-apps-db`, foundry's own TLS
+ * Postgres, `apps-db.ts`; the one the apps admin role lives on). Boule creates a database per app copy on
+ * that server (`app_<app>_<copy>`) and the edge it calls makes one Hyperdrive config per database.
+ * Hyperdrive reaches a database inside Coolify's Docker network only through the company's Cloudflare
+ * tunnel behind an Access service token, so this step makes the route once for the server, not once per
+ * database:
  *
  *   Access app on `<8 hex of org id>-apps-db-hd.<zone>` (a service-token policy) -> tunnel rule
- *   `tcp://<server host>:5432` -> proxied CNAME to the tunnel,
+ *   `tcp://<slug>-apps-db:5432` -> proxied CNAME to the tunnel,
  *
  * the same three parts `worker-app-database.ts` makes for a Worker app's own database (`ensureDatabaseRoute`
  * is shared), under the scope-id family `bgdb.apps-db.*`, so org destroy and the existing teardown find them.
@@ -19,20 +21,28 @@ import { type WorkerAppDatabaseDeps } from './worker-app-database.js';
  *
  * Boule's env gets: {@link APPS_DATABASE_HOST_ENV} (the tunnel hostname Hyperdrive connects to),
  * {@link APPS_DATABASE_ACCESS_CLIENT_ID_ENV} and {@link APPS_DATABASE_ACCESS_CLIENT_SECRET_ENV} (the Access
- * service token), {@link APPS_DATABASE_PORT_ENV}. The company's Postgres server speaks no TLS of its own, so
- * there is no CA to give: the encrypted leg is Hyperdrive to Cloudflare's edge and the tunnel.
+ * service token), {@link APPS_DATABASE_PORT_ENV}.
+ *
+ * Hyperdrive refuses an origin that does not speak TLS (Cloudflare error 2012), tunnel or not, and a Coolify
+ * database cannot turn TLS on. That is why the route goes to foundry's own TLS server and not to the
+ * company's Coolify Postgres server `<slug>-postgres`. The server accepts TLS connections only, so
+ * Hyperdrive's default `sslmode=require` works and no CA is given. A company whose route was recorded
+ * against `<slug>-postgres` is moved by the next plan: the applied marker names the hostname and the
+ * server, the tunnel rule is written again, and nothing on the old server is touched.
  */
-export declare const APPS_DB_ENTRY_KEY = "apps-db";
+export { APPS_DB_ENTRY_KEY };
 export declare const APPS_DATABASE_HOST_ENV = "APPS_DATABASE_HOST";
 export declare const APPS_DATABASE_PORT_ENV = "APPS_DATABASE_PORT";
 export declare const APPS_DATABASE_ACCESS_CLIENT_ID_ENV = "APPS_DATABASE_ACCESS_CLIENT_ID";
 export declare const APPS_DATABASE_ACCESS_CLIENT_SECRET_ENV = "APPS_DATABASE_ACCESS_CLIENT_SECRET";
 export declare const APPS_DATABASE_ADMIN_URL_ENV = "APPS_DATABASE_ADMIN_URL";
 export declare const APPS_DATABASE_ROUTE_ENVS: readonly ["APPS_DATABASE_HOST", "APPS_DATABASE_PORT", "APPS_DATABASE_ACCESS_CLIENT_ID", "APPS_DATABASE_ACCESS_CLIENT_SECRET"];
-/** The tunnel hostname last written to Boule, recorded last so a failed run is repeated. */
+/** The route last written to Boule ({@link appsDbRouteMarker}), recorded last so a failed run is repeated. */
 export declare const APPS_DB_ROUTE_APPLIED_SCOPE_KEY = "apps_db_route_applied";
 /** The tunnel hostname of the company's apps database route. */
 export declare const appsDbHostname: (org: DeclaredOrg) => string;
+/** The applied marker: the tunnel hostname and the server it reaches. A route recorded with the hostname alone (the old Postgres server) differs, so it is planned again. */
+export declare const appsDbRouteMarker: (org: DeclaredOrg) => string;
 export interface PlanAppsDbRouteOptions {
     /** Access, tunnel, DNS and zone ports are available (edge). */
     accessReady: boolean;
@@ -70,8 +80,6 @@ export interface AppsDbRouteDeps {
     };
     /** Registers a value for redaction before it is written anywhere. */
     secret(value: string): void;
-    /** The Postgres server's host inside the Docker network (its internal URL's host). */
-    upstreamHost(serverId: string): Promise<string>;
     boule: AppsDbRouteBoule;
     /** Test hook: the timeout of a call, in ms. */
     timeoutMs?: number;
@@ -86,5 +94,3 @@ export declare function applyAppsDbRoute(deps: AppsDbRouteDeps, org: DeclaredOrg
 export declare function retireAppsDbRoute(deps: AppsDbRouteDeps, org: DeclaredOrg, context: StepExecutionContext): Promise<void>;
 /** The held secret ref of the route's Access token (for tests and the executor). */
 export declare const appsDbAccessRef: (org: Pick<DeclaredOrg, "id">) => string;
-/** True when the apps admin role is recorded: the route is worth making only with it (used by the planner's caller). */
-export declare const appsAdminRecorded: (recorded: Readonly<Record<string, string>>) => boolean;

package/dist/plan/apps-db-route.js

@@ -1,18 +1,19 @@
-import { ORG_POSTGRES_SERVER_SCOPE_KEY, appsOn } from '../org.js';
+import { appsOn } from '../org.js';
 import { withCallTimeout } from '../worker-app-upload.js';
-import { ORG_APPS_ADMIN_SCOPE_KEY } from './org-apps-admin.js';
+import { APPS_DB_SCOPE_KEYS, appsDbName, appsDbRecorded } from './apps-db.js';
 import { REMOTE_DATABASE_PORT, remoteDatabaseKeys } from './remote-database.js';
 import { deleteWorkerAppDatabaseRoute, ensureDatabaseRoute, ensureServiceToken, hyperdriveHostname, } from './worker-app-database.js';
-import { WORKER_APP_CALL_TIMEOUT_MS, workerAppApex, workerAppSecretRef } from './worker-app.js';
+import { APPS_DB_ENTRY_KEY, WORKER_APP_CALL_TIMEOUT_MS, workerAppApex, workerAppSecretRef, } from './worker-app.js';
 /**
- * F4 (#925): the Hyperdrive route to the company's own Postgres server (`<slug>-postgres`, the one the
- * apps admin role lives on). Boule creates a database per app copy on that server (`app_<app>_<copy>`) and
- * the edge it calls makes one Hyperdrive config per database. Hyperdrive reaches a database inside Coolify's
- * Docker network only through the company's Cloudflare tunnel behind an Access service token, so this step
- * makes the route once for the server, not once per database:
+ * F4 (#925): the Hyperdrive route to the company's apps database (`<slug>-apps-db`, foundry's own TLS
+ * Postgres, `apps-db.ts`; the one the apps admin role lives on). Boule creates a database per app copy on
+ * that server (`app_<app>_<copy>`) and the edge it calls makes one Hyperdrive config per database.
+ * Hyperdrive reaches a database inside Coolify's Docker network only through the company's Cloudflare
+ * tunnel behind an Access service token, so this step makes the route once for the server, not once per
+ * database:
  *
  *   Access app on `<8 hex of org id>-apps-db-hd.<zone>` (a service-token policy) -> tunnel rule
- *   `tcp://<server host>:5432` -> proxied CNAME to the tunnel,
+ *   `tcp://<slug>-apps-db:5432` -> proxied CNAME to the tunnel,
  *
  * the same three parts `worker-app-database.ts` makes for a Worker app's own database (`ensureDatabaseRoute`
  * is shared), under the scope-id family `bgdb.apps-db.*`, so org destroy and the existing teardown find them.
@@ -21,10 +22,16 @@ import { WORKER_APP_CALL_TIMEOUT_MS, workerAppApex, workerAppSecretRef } from '.
  *
  * Boule's env gets: {@link APPS_DATABASE_HOST_ENV} (the tunnel hostname Hyperdrive connects to),
  * {@link APPS_DATABASE_ACCESS_CLIENT_ID_ENV} and {@link APPS_DATABASE_ACCESS_CLIENT_SECRET_ENV} (the Access
- * service token), {@link APPS_DATABASE_PORT_ENV}. The company's Postgres server speaks no TLS of its own, so
- * there is no CA to give: the encrypted leg is Hyperdrive to Cloudflare's edge and the tunnel.
+ * service token), {@link APPS_DATABASE_PORT_ENV}.
+ *
+ * Hyperdrive refuses an origin that does not speak TLS (Cloudflare error 2012), tunnel or not, and a Coolify
+ * database cannot turn TLS on. That is why the route goes to foundry's own TLS server and not to the
+ * company's Coolify Postgres server `<slug>-postgres`. The server accepts TLS connections only, so
+ * Hyperdrive's default `sslmode=require` works and no CA is given. A company whose route was recorded
+ * against `<slug>-postgres` is moved by the next plan: the applied marker names the hostname and the
+ * server, the tunnel rule is written again, and nothing on the old server is touched.
  */
-export const APPS_DB_ENTRY_KEY = 'apps-db';
+export { APPS_DB_ENTRY_KEY };
 export const APPS_DATABASE_HOST_ENV = 'APPS_DATABASE_HOST';
 export const APPS_DATABASE_PORT_ENV = 'APPS_DATABASE_PORT';
 export const APPS_DATABASE_ACCESS_CLIENT_ID_ENV = 'APPS_DATABASE_ACCESS_CLIENT_ID';
@@ -36,10 +43,12 @@ export const APPS_DATABASE_ROUTE_ENVS = [
     APPS_DATABASE_ACCESS_CLIENT_ID_ENV,
     APPS_DATABASE_ACCESS_CLIENT_SECRET_ENV,
 ];
-/** The tunnel hostname last written to Boule, recorded last so a failed run is repeated. */
+/** The route last written to Boule ({@link appsDbRouteMarker}), recorded last so a failed run is repeated. */
 export const APPS_DB_ROUTE_APPLIED_SCOPE_KEY = 'apps_db_route_applied';
 /** The tunnel hostname of the company's apps database route. */
 export const appsDbHostname = (org) => hyperdriveHostname(org, APPS_DB_ENTRY_KEY, workerAppApex(org));
+/** The applied marker: the tunnel hostname and the server it reaches. A route recorded with the hostname alone (the old Postgres server) differs, so it is planned again. */
+export const appsDbRouteMarker = (org) => `${appsDbHostname(org)}|${appsDbName(org)}`;
 const routeKeys = remoteDatabaseKeys(APPS_DB_ENTRY_KEY);
 /**
  * Pure. `apply` once the company's apps are on and everything the route needs is recorded or planned;
@@ -77,8 +86,9 @@ export function planAppsDbRoute(org, recordedIds, plannedSteps, options) {
     }
     const planned = (system, kind) => plannedSteps.some((p) => p.action.system === system && p.action.kind === kind && p.action.key === org.id);
     const hostname = appsDbHostname(org);
-    if (recordedIds[APPS_DB_ROUTE_APPLIED_SCOPE_KEY] === hostname)
+    if (recordedIds[APPS_DB_ROUTE_APPLIED_SCOPE_KEY] === appsDbRouteMarker(org)) {
         return { steps: [], blocked };
+    }
     if (!options.accessReady)
         return block('the host supplies no Access, tunnel, DNS or zone port');
     if (!options.canHoldSecrets)
@@ -87,8 +97,8 @@ export function planAppsDbRoute(org, recordedIds, plannedSteps, options) {
     if (lost) {
         return block(`service token ${lost} was created but its secret was never saved, so it cannot be used. To start over, turn apps off and apply (that removes the route and clears this note), delete the token ${lost} in Cloudflare Zero Trust if it is still listed, then turn apps on again`);
     }
-    if (!recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY] && !planned('coolify', 'org-postgres')) {
-        return block('its Postgres server is not provisioned yet');
+    if (!appsDbRecorded(recordedIds) && !planned('coolify', 'apps-db')) {
+        return block('its apps database is not provisioned yet');
     }
     if (!options.tunnelReady)
         return block("the company's Cloudflare tunnel is not applied yet");
@@ -97,7 +107,9 @@ export function planAppsDbRoute(org, recordedIds, plannedSteps, options) {
     }
     return {
         steps: [
-            draft({ mode: 'apply', hostname }, `make ${org.slug}'s apps database route (${hostname}) and give Boule the host and its Access token`),
+            draft({ mode: 'apply', hostname }, recordedRoute
+                ? `point ${org.slug}'s apps database route (${hostname}) at ${appsDbName(org)} and give Boule the host and its Access token`
+                : `make ${org.slug}'s apps database route (${hostname}) and give Boule the host and its Access token`),
         ],
         blocked,
     };
@@ -113,17 +125,17 @@ export async function applyAppsDbRoute(deps, org, context) {
     const recorded = context.recordedIds();
     if (!appsOn(org))
         throw new Error(`${at}: the company's Boule runs no apps (org.boule.apps)`);
-    const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
-    if (!serverId)
-        throw new Error(`${at}: ${org.slug}'s Postgres server is not recorded yet`);
+    const serverId = recorded[APPS_DB_SCOPE_KEYS.app];
+    if (!serverId || !recorded[APPS_DB_SCOPE_KEYS.tls]) {
+        throw new Error(`${at}: ${org.slug}'s apps database is not recorded yet`);
+    }
     const tunnelId = recorded[`cloudflare:tunnel:${org.id}`];
     if (!tunnelId)
         throw new Error(`${at}: ${org.slug}'s Cloudflare tunnel is not applied yet`);
     if (!recorded[`coolify:boule:${org.id}`])
         throw new Error(`${at}: Boule is not recorded yet`);
-    const upstreamHost = await call('read the database host', () => deps.upstreamHost(serverId));
-    if (!upstreamHost)
-        throw new Error(`${at}: the Postgres server reports no host`);
+    // The server's host inside the Docker network is its app's own name (`custom_internal_name`).
+    const upstreamHost = appsDbName(org);
     const hostname = appsDbHostname(org);
     const access = await ensureServiceToken({ access: deps.database.access, heldKeys: deps.heldKeys, secret: deps.secret }, org, { key: APPS_DB_ENTRY_KEY }, `${org.slug}-apps`, at, call, context, put);
     await ensureDatabaseRoute(deps.database, call, context, {
@@ -145,7 +157,7 @@ export async function applyAppsDbRoute(deps, org, context) {
         { key: APPS_DATABASE_ACCESS_CLIENT_SECRET_ENV, value: access.clientSecret, literal: true },
     ]));
     await call('restart Boule', () => deps.boule.restart());
-    context.recordScopeId(APPS_DB_ROUTE_APPLIED_SCOPE_KEY, hostname);
+    context.recordScopeId(APPS_DB_ROUTE_APPLIED_SCOPE_KEY, appsDbRouteMarker(org));
     await context.persistScopeIds();
 }
 /**
@@ -164,5 +176,3 @@ export async function retireAppsDbRoute(deps, org, context) {
 }
 /** The held secret ref of the route's Access token (for tests and the executor). */
 export const appsDbAccessRef = (org) => workerAppSecretRef(org.id, APPS_DB_ENTRY_KEY, 'HYPERDRIVE_ACCESS');
-/** True when the apps admin role is recorded: the route is worth making only with it (used by the planner's caller). */
-export const appsAdminRecorded = (recorded) => Boolean(recorded[ORG_APPS_ADMIN_SCOPE_KEY]);

package/dist/plan/apps-db.d.ts

@@ -0,0 +1,76 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import { type ProjectSource, type StepScope } from './own-services.js';
+import type { PlatformAuthDeps } from './platform-providers.js';
+import { type SigninDbKeys } from './signin-db-tls.js';
+import { type SigninDbRuntime } from './signin-db.js';
+/**
+ * The company's apps database: the Postgres server Boule creates a database per app copy on
+ * (`app_<app>_<copy>`) and Cloudflare Hyperdrive reaches through the company's tunnel. Hyperdrive
+ * refuses an origin that does not speak TLS, tunnel or not (error 2012), and Coolify 4.4.2 cannot turn
+ * on a database's TLS, so this server is foundry's own TLS Postgres, the same image and machinery as
+ * the Worker app database (`worker-app-db.ts`, `signin-db.ts`): `<slug>-apps-db`, planned while
+ * `appsOn(org)`. It is a server of its own, not `<slug>-app-db`, because that one holds a Worker app's
+ * data under one owner and backs up one database; this one holds whatever Boule creates and its
+ * nightly dump takes the whole server.
+ *
+ * The server's superuser `apps_owner` is for foundry's own steps (the apps admin role job); Boule gets
+ * the narrow `<slug>_apps_admin` role only. Every network connection must be TLS with a password
+ * (`hostssl` only), so `sslmode=require` is enough for a client, with no CA file to hand out. The org's
+ * CA is held under {@link appsDbCaRef}; the server certificate is renewed by planning the step again
+ * when it is due. Apps off plans nothing for it and deletes nothing: the server and its data stay.
+ */
+/** Recorded ids: the app, "the step finished", and the server certificate's expiry. */
+export declare const APPS_DB_SCOPE_KEYS: import("./signin-db-tls.js").TlsDbScopeKeys;
+/** `unmanaged` key of the one blocked line {@link planAppsDb} reports. */
+export declare const APPS_DB_BLOCKED_KEY = "apps-db";
+export declare const APPS_DB_USER = "apps_owner";
+export declare const APPS_DB_DATABASE = "postgres";
+export declare const APPS_DB_BACKUP_PREFIX = "apps-db";
+export declare const appsDbCaRef: (orgId: string) => string;
+export declare const appsDbServerRef: (orgId: string) => string;
+/** The server's name in Coolify and its host inside the Docker network. */
+export declare const appsDbName: (org: Pick<DeclaredOrg, "slug">) => string;
+/** The server is made: its app and the "finished" marker are recorded. */
+export declare const appsDbRecorded: (recordedIds: Readonly<Record<string, string>>) => boolean;
+export interface PlanAppsDbOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    now: number;
+    /** The held keys can store the CA and certificate. Default true. */
+    keysPuttable?: boolean;
+    /** The host supplies the backup bucket the server dumps into. Default true. */
+    backupConfigured?: boolean;
+}
+/**
+ * One `coolify:apps-db` step per org whose Boule runs apps: planned until the app and the "finished"
+ * marker are recorded, and again when the server certificate is due. A step that cannot succeed yet
+ * (no held-key put, no backup bucket) is a blocked line, not a step. With apps off nothing is planned.
+ */
+export declare function planAppsDb(options: PlanAppsDbOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
+export interface ProvisionAppsDbDeps {
+    coolify: PlatformAuthDeps['coolify'];
+    heldKeys: SigninDbKeys | undefined;
+    signinDbBackup: PlatformAuthDeps['signinDbBackup'];
+    runtime?: SigninDbRuntime;
+}
+/**
+ * Brings the org's apps database up (`provisionSigninDb` with the apps database's names) and records the
+ * "finished" marker last, so a run that died halfway is planned again. Returns the app id. A failure
+ * halfway leaves the CA and certificate held (never made twice), the app, its volume and its recorded
+ * id in place; nothing is deleted, and the next apply continues from there.
+ */
+export declare function provisionAppsDb(scope: StepScope, deps: ProvisionAppsDbDeps, org: DeclaredOrg, input: {
+    project: ProjectSource;
+    label: string;
+}): Promise<{
+    appId: string;
+}>;
+/**
+ * The superuser's address for foundry's own steps (the apps admin role job): the server's internal host
+ * and the password in its env. It asks for TLS, which the server demands. A secret.
+ */
+export declare function appsDbAdminUrl(coolify: Pick<PlatformAuthDeps['coolify'], 'listEnvs'>, org: DeclaredOrg, appId: string): Promise<string>;

package/dist/plan/apps-db.js

@@ -0,0 +1,132 @@
+import { appsOn } from '../org.js';
+import { orgTarget } from './own-services.js';
+import { signinDbCertDue, tlsDbScopeKeys } from './signin-db-tls.js';
+import { SIGNIN_DB_ENV, SIGNIN_DB_PORT, dockerfileAppCreator, provisionSigninDb, withCallTimeout, } from './signin-db.js';
+/**
+ * The company's apps database: the Postgres server Boule creates a database per app copy on
+ * (`app_<app>_<copy>`) and Cloudflare Hyperdrive reaches through the company's tunnel. Hyperdrive
+ * refuses an origin that does not speak TLS, tunnel or not (error 2012), and Coolify 4.4.2 cannot turn
+ * on a database's TLS, so this server is foundry's own TLS Postgres, the same image and machinery as
+ * the Worker app database (`worker-app-db.ts`, `signin-db.ts`): `<slug>-apps-db`, planned while
+ * `appsOn(org)`. It is a server of its own, not `<slug>-app-db`, because that one holds a Worker app's
+ * data under one owner and backs up one database; this one holds whatever Boule creates and its
+ * nightly dump takes the whole server.
+ *
+ * The server's superuser `apps_owner` is for foundry's own steps (the apps admin role job); Boule gets
+ * the narrow `<slug>_apps_admin` role only. Every network connection must be TLS with a password
+ * (`hostssl` only), so `sslmode=require` is enough for a client, with no CA file to hand out. The org's
+ * CA is held under {@link appsDbCaRef}; the server certificate is renewed by planning the step again
+ * when it is due. Apps off plans nothing for it and deletes nothing: the server and its data stay.
+ */
+/** Recorded ids: the app, "the step finished", and the server certificate's expiry. */
+export const APPS_DB_SCOPE_KEYS = tlsDbScopeKeys('apps_db');
+/** `unmanaged` key of the one blocked line {@link planAppsDb} reports. */
+export const APPS_DB_BLOCKED_KEY = 'apps-db';
+export const APPS_DB_USER = 'apps_owner';
+export const APPS_DB_DATABASE = 'postgres';
+export const APPS_DB_BACKUP_PREFIX = 'apps-db';
+export const appsDbCaRef = (orgId) => `apps-db:${orgId}:ca`;
+export const appsDbServerRef = (orgId) => `apps-db:${orgId}:server`;
+/** The server's name in Coolify and its host inside the Docker network. */
+export const appsDbName = (org) => `${org.slug}-apps-db`;
+/** The server is made: its app and the "finished" marker are recorded. */
+export const appsDbRecorded = (recordedIds) => Boolean(recordedIds[APPS_DB_SCOPE_KEYS.app] && recordedIds[APPS_DB_SCOPE_KEYS.tls]);
+/**
+ * One `coolify:apps-db` step per org whose Boule runs apps: planned until the app and the "finished"
+ * marker are recorded, and again when the server certificate is due. A step that cannot succeed yet
+ * (no held-key put, no backup bucket) is a blocked line, not a step. With apps off nothing is planned.
+ */
+export function planAppsDb(options) {
+    const { org, recordedIds } = options;
+    if (!appsOn(org))
+        return { step: null, blocked: null };
+    const done = appsDbRecorded(recordedIds);
+    if (done && !signinDbCertDue(recordedIds, options.now, APPS_DB_SCOPE_KEYS)) {
+        return { step: null, blocked: null };
+    }
+    if (options.keysPuttable === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s apps database is blocked, not planned: the host cannot store the database certificate (held keys have no put)`,
+        };
+    }
+    if (options.backupConfigured === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s apps database is blocked, not planned: the host supplies no backup bucket for the database`,
+        };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: { system: 'coolify', kind: 'apps-db', key: org.id, desired: {} },
+            step: {
+                description: done
+                    ? `renew the server certificate of ${org.slug}'s apps database`
+                    : `provision ${org.slug}'s apps database (${appsDbName(org)}) as a TLS Postgres`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/**
+ * Brings the org's apps database up (`provisionSigninDb` with the apps database's names) and records the
+ * "finished" marker last, so a run that died halfway is planned again. Returns the app id. A failure
+ * halfway leaves the CA and certificate held (never made twice), the app, its volume and its recorded
+ * id in place; nothing is deleted, and the next apply continues from there.
+ */
+export async function provisionAppsDb(scope, deps, org, input) {
+    const coolify = withCallTimeout(deps.coolify);
+    const name = appsDbName(org);
+    const keys = APPS_DB_SCOPE_KEYS;
+    const record = async (key, id) => {
+        scope.recordScopeId(key, id);
+        await scope.persist();
+    };
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    const db = await provisionSigninDb({
+        coolify,
+        keys: deps.heldKeys,
+        runtime: deps.runtime ?? {},
+        name,
+        internalHost: name,
+        volumeName: `${name}-data`,
+        serverCertRef: appsDbServerRef(org.id),
+        slug: org.slug,
+        backup: deps.signinDbBackup,
+        backupBucket: orgTarget(org).names.signinBackupBucket,
+        recorded: scope.recordedIds(),
+        label: input.label,
+        environment,
+        record,
+        create: dockerfileAppCreator(coolify, {
+            projectUuid,
+            environment,
+            name,
+            description: `${org.slug}'s apps database with TLS`,
+        }),
+    }, {
+        appName: name,
+        user: APPS_DB_USER,
+        database: APPS_DB_DATABASE,
+        caRef: appsDbCaRef(org.id),
+        caCommonName: `foundry ${org.slug} apps database CA`,
+        scopeKeys: keys,
+        backupPrefix: APPS_DB_BACKUP_PREFIX,
+        dumpAll: true,
+    });
+    await record(keys.tls, db.appId);
+    return { appId: db.appId };
+}
+/**
+ * The superuser's address for foundry's own steps (the apps admin role job): the server's internal host
+ * and the password in its env. It asks for TLS, which the server demands. A secret.
+ */
+export async function appsDbAdminUrl(coolify, org, appId) {
+    const password = (await coolify.listEnvs(appId)).find((e) => e.key === SIGNIN_DB_ENV.password && !e.is_preview && e.value)?.value;
+    if (!password)
+        throw new Error(`${org.slug}'s apps database holds no password yet`);
+    return `postgres://${APPS_DB_USER}:${encodeURIComponent(password)}@${appsDbName(org)}:${SIGNIN_DB_PORT}/${APPS_DB_DATABASE}?sslmode=require`;
+}

package/dist/plan/diff.js

@@ -6,6 +6,7 @@ import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPEC
 import { planAnalyticsBoule } from './analytics-boule.js';
 import { analyticsEnvDrift, analyticsWanted, desiredAnalyticsEnv } from './analytics.js';
 import { planAppsDbRoute } from './apps-db-route.js';
+import { APPS_DB_BLOCKED_KEY, planAppsDb } from './apps-db.js';
 import { planAppsZones } from './apps-zones.js';
 import { bgKey, planBlueGreen, } from './blue-green.js';
 import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_MAIL_TOKEN_ENV, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, customersOrgIdOf, customersRoomValue, desiredBouleEnv, planBouleOwners, staleCustomersEnv, wantedBouleBrokerEntry, } from './boule.js';
@@ -920,10 +921,20 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
         plannedSteps.push(desktopCallbacks);
     // #444, last: a Postgres step that fails must not stop the zone, mail, app, Agora and Boule steps of a live company.
     plannedSteps.push(...orgPostgresSteps);
-    // F4 (#925): with apps on, the apps admin role on that server and the route Hyperdrive reaches it by.
+    // F4 (#925): with apps on, the company's apps database (a TLS Postgres: Hyperdrive refuses one without),
+    // then the apps admin role on it and the route Hyperdrive reaches it by.
+    const appsDb = planAppsDb({
+        org,
+        recordedIds,
+        now: (options.now ?? Date.now)(),
+        keysPuttable: options.workerAppDbKeysPuttable ?? true,
+        backupConfigured: options.workerAppDbBackupConfigured ?? true,
+    });
+    if (appsDb.step)
+        plannedSteps.push(appsDb.step);
     const appsAdmin = planAppsAdmin(org, recordedIds, plannedSteps, {
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
-        postgresPlanned: orgPostgresSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'org-postgres'),
+        appsDbPlanned: Boolean(appsDb.step),
     });
     plannedSteps.push(...appsAdmin.steps);
     const appsDbRoute = planAppsDbRoute(org, recordedIds, plannedSteps, {
@@ -1020,6 +1031,9 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
     unmanaged.push(...workerApps.blocked);
+    if (appsDb.blocked) {
+        unmanaged.push({ description: appsDb.blocked, key: APPS_DB_BLOCKED_KEY });
+    }
     if (workerAppDb.blocked) {
         unmanaged.push({ description: workerAppDb.blocked, key: WORKER_APP_DB_BLOCKED_KEY });
     }
@@ -4208,6 +4222,17 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
  * `HostingEntry.database`, #71) -- `validateHosting` requires
  * `hosting.enabled` before this can be true. Same park-not-delete shape as
  * {@link planApp}.
+ *
+ * #1038: the default `isOn` (`live.config.enabled !== false`) never sees a
+ * park step's work, because providers' own database config carries no
+ * `enabled` field -- only a Coolify `status` (`ProvidersCoolifyReader`
+ * passes `database.status` straight into `config.status`). A stopped
+ * database therefore always read as on, so a company with no entry left
+ * using a database re-planned the park step forever and Archon's
+ * company-app apply, which refuses every install while a step that
+ * destroys data is pending, could never clear it. `isOn` here reads
+ * `config.status` instead, the same `exited`/`stopped` convention
+ * {@link planKosmos} already uses for its own park step.
  */
 function planDatabase(org, byKey, claimed, recordedIds) {
     // #444: only a company whose app database is still its own Coolify database
@@ -4225,7 +4250,7 @@ function planDatabase(org, byKey, claimed, recordedIds) {
     if (!appHome || !legacy || !recordedIds[legacy] || serviceOnServer(org, appHome, recordedIds)) {
         return null;
     }
-    return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);
+    return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`, org.id, (live) => !/^(exited|stopped)/.test(String(live.config.status ?? '')));
 }
 function sortedNames(names) {
     return names.filter(Boolean).sort().join(',');

package/dist/plan/executor.d.ts

@@ -3641,6 +3641,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private ownAuthDeps;
     /** `plan/worker-app-db.ts`: the org's Worker app database as a TLS Postgres, and its server certificate's renewal. */
     private workerAppDb;
+    /** `plan/apps-db.ts`: the company's apps database as a TLS Postgres, and its server certificate's renewal. */
+    private appsDb;
     /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
     private ownAuthDbMove;
     private ownAuth;

package/dist/plan/executor.js

@@ -12,6 +12,7 @@ import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID
 import { ANALYTICS_BOULE_APPLIED_SCOPE_KEY, ANALYTICS_BOULE_ENV_NAMES, analyticsBouleMarker, } from './analytics-boule.js';
 import { ANALYTICS_DATABASE_SCOPE_KEY, ANALYTICS_DEPLOYED_SCOPE_KEY, ANALYTICS_OPERATOR_KEY_ENV, analyticsEnvDrift, analyticsHostnameFor, analyticsUrlFor, desiredAnalyticsEnv, } from './analytics.js';
 import { APPS_DATABASE_ADMIN_URL_ENV, applyAppsDbRoute, retireAppsDbRoute, } from './apps-db-route.js';
+import { appsDbAdminUrl, provisionAppsDb } from './apps-db.js';
 import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from './apps-zones.js';
 import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
 import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, mintPinKey, parseGuards, pinKeyName, splitServers, } from './blue-green.js';
@@ -1230,9 +1231,12 @@ export class FoundryStepExecutor {
     }
     async execute(action, context) {
         const { org } = context;
-        // The Worker app database uses only platform ports, and its backup needs the files host's
+        // The Worker app and apps databases use only platform ports, and their backup needs the files host's
         // bucket and key ports, which the scoped copy drops with `ownServices` (foundry#878).
-        if (ownsServices(org) && !action.kind.startsWith('own-') && action.kind !== 'worker-app-db') {
+        if (ownsServices(org) &&
+            !action.kind.startsWith('own-') &&
+            action.kind !== 'worker-app-db' &&
+            action.kind !== 'apps-db') {
             return this.executeScoped(action, context);
         }
         return this.run(action, context);
@@ -1433,6 +1437,8 @@ export class FoundryStepExecutor {
                 return this.ownAuthDbMove(org, context);
             case 'coolify:worker-app-db':
                 return this.workerAppDb(org, context);
+            case 'coolify:apps-db':
+                return this.appsDb(org, context);
             case 'coolify:own-jobs':
                 return this.ownJobs(action, org, context);
             case 'coolify:own-jobs-route':
@@ -4519,9 +4525,17 @@ export class FoundryStepExecutor {
         const base = this.orgPostgresDeps(org, context);
         const boule = this.appsBoule(org, context);
         const { deliverSecret: _held, ...shared } = base;
+        const withAppsDb = {
+            ...shared,
+            appsDbAdminUrl: async (appId) => {
+                const url = await appsDbAdminUrl(this.ports.coolify, org, appId);
+                this.handledSecrets.add(url);
+                return url;
+            },
+        };
         if (action.desired.mode === 'retire') {
             await retireOrgAppsAdmin(scopeFromOrg(context, {}), {
-                ...shared,
+                ...withAppsDb,
                 clearHeldUrl: async (ref) => {
                     // The deliver sink has no delete; the held-key store blanks a value (an empty one reads as not held).
                     if (typeof this.ports.heldKeys?.put !== 'function') {
@@ -4543,7 +4557,7 @@ export class FoundryStepExecutor {
         if (!boule)
             throw new Error(`${at}: Boule is not recorded yet`);
         const deps = {
-            ...shared,
+            ...withAppsDb,
             deliverSecret: async (ref, url) => {
                 await this.ports.deliverSecret(ref, url);
                 await boule.upsertEnvs([{ key: APPS_DATABASE_ADMIN_URL_ENV, value: url, literal: true }]);
@@ -4576,13 +4590,6 @@ export class FoundryStepExecutor {
             },
             heldKeys,
             secret: (value) => void this.handledSecrets.add(value),
-            upstreamHost: async (serverId) => {
-                const server = await getDatabaseStarted(this.ports.coolify, serverId);
-                if (!server.internal_db_url || !URL.canParse(server.internal_db_url))
-                    return '';
-                this.handledSecrets.add(server.internal_db_url);
-                return new URL(server.internal_db_url).hostname;
-            },
             boule: boule ?? {
                 upsertEnvs: async () => undefined,
                 deleteEnvs: async () => undefined,
@@ -9052,6 +9059,26 @@ export class FoundryStepExecutor {
         });
         return {};
     }
+    /** `plan/apps-db.ts`: the company's apps database as a TLS Postgres, and its server certificate's renewal. */
+    async appsDb(org, context) {
+        const files = this.ports.ownServices?.provision.files;
+        await provisionAppsDb(scopeFromOrg(context, {}), {
+            coolify: this.placedForCompany(this.ports.coolify, org, context),
+            heldKeys: this.ports.heldKeys,
+            signinDbBackup: files?.r2Buckets && files.r2Keys
+                ? { r2Buckets: files.r2Buckets, r2Keys: files.r2Keys }
+                : undefined,
+            runtime: {
+                ...(this.ports.runtime?.sleep ? { sleep: this.ports.runtime.sleep } : {}),
+                ...(this.ports.runtime?.now ? { now: this.ports.runtime.now } : {}),
+                onSecret: (value) => void this.handledSecrets.add(value),
+            },
+        }, org, {
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            label: `${org.slug}:apps-db`,
+        });
+        return {};
+    }
     /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
     async ownAuthDbMove(org, context) {
         const own = this.ports.ownServices;
@@ -11782,14 +11809,14 @@ export function isNoChangesError(error) {
 export async function allowPerAppLoginBaseUris(zitadel, instanceBaseUri) {
     if (!zitadel.allowPerAppLoginBaseUri)
         return;
-    const { listOrgs, listProjects } = zitadel;
-    if (!listOrgs || !listProjects) {
+    // Called on the port, never pulled off it: a client class reads `this` in each method.
+    if (!zitadel.listOrgs || !zitadel.listProjects) {
         throw new Error('the ZITADEL port cannot list every organisation and project, so apps without a login base URI would fall back to the v1 login');
     }
-    for (const org of await listOrgs()) {
+    for (const org of await zitadel.listOrgs()) {
         if (org.state && org.state !== 'ORG_STATE_ACTIVE')
             continue;
-        for (const project of await listProjects(org.id)) {
+        for (const project of await zitadel.listProjects(org.id)) {
             if (project.state && project.state !== 'PROJECT_STATE_ACTIVE')
                 continue;
             const listed = await zitadel.listApps(org.id, project.id);

package/dist/plan/org-apps-admin.d.ts

@@ -7,11 +7,24 @@ import type { StepScope } from './own-services.js';
 export declare const appsAdminRoleName: (org: Pick<DeclaredOrg, "slug">) => string;
 /** The job app's name in Coolify. */
 export declare const appsAdminJobName: (org: Pick<DeclaredOrg, "slug">) => string;
-/** Recorded once the role is made, its password set, and the URL delivered. */
+/** Recorded once the role is made, its password set, and the URL delivered: {@link appsAdminDoneValue}, or the old server's name. */
 export declare const ORG_APPS_ADMIN_SCOPE_KEY = "org_apps_admin";
+/**
+ * What {@link ORG_APPS_ADMIN_SCOPE_KEY} holds when the role is on the apps database and the job that made it
+ * also closed `postgres` and `template1` to PUBLIC. A company recorded with the bare server name (a version
+ * before the revokes) is planned once more, which runs the whole idempotent job again.
+ */
+export declare const appsAdminDoneValue: (org: Pick<DeclaredOrg, "slug">) => string;
+/**
+ * Set to the server's name when a mint job failed, while the role may have been made there. Not a note that
+ * blocks anything: it only makes turning apps off retire the role on the apps database, so a role that
+ * {@link ORG_APPS_ADMIN_SCOPE_KEY} never recorded is not left able to log in.
+ */
+export declare const ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY = "org_apps_admin_touched";
 /**
  * An opaque id, set once the password is minted and the job that sets it is about to run, until the URL is
- * delivered. Never the password. A failure before that point leaves no id, so the next apply tries again.
+ * delivered. Never the password. A failure before that point leaves no id, and a job that fails clears it (the
+ * mint is idempotent and delivered nothing), so the next apply tries again.
  */
 export declare const ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY = "org_apps_admin_undelivered";
 /** The job app's id while it exists. */
@@ -34,14 +47,23 @@ export declare function planOrgAppsAdminStep(org: Pick<DeclaredOrg, 'id' | 'slug
     step: DraftStep | null;
     blocked: string | null;
 };
+/**
+ * The servers a retire has to reach: the apps database when the role is recorded on it (or a mint is
+ * pending, which only ever runs against it), and the old `<slug>-postgres` server when the role was made
+ * there by an earlier version (or a mint of that version was never delivered, which could be on either).
+ */
+export declare function appsAdminRetireTargets(org: Pick<DeclaredOrg, 'slug'>, recorded: Readonly<Record<string, string>>): {
+    legacy: boolean;
+    current: boolean;
+};
 export interface PlanAppsAdminOptions {
     canHoldSecrets: boolean;
-    /** `coolify:org-postgres` is planned in this same plan, ahead of this step. */
-    postgresPlanned: boolean;
+    /** `coolify:apps-db` is planned in this same plan, ahead of this step. */
+    appsDbPlanned: boolean;
 }
 /**
  * Pure. F4 (#925): the wiring of {@link planOrgAppsAdminStep} to `org.boule.apps`. Apps on: the mint
- * step, once Boule (which receives the URL) and the Postgres server are recorded or planned. Apps off with
+ * step, once Boule (which receives the URL) and the apps database are recorded or planned. Apps off with
  * the role recorded (or a mint never delivered): the retire step, which needs no secret and drops nothing.
  */
 export declare function planAppsAdmin(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], options: PlanAppsAdminOptions): {
@@ -52,8 +74,8 @@ export declare function planAppsAdmin(org: DeclaredOrg, recordedIds: Readonly<Re
     }>;
 };
 /**
- * The job's script: makes the role (idempotent, kept if it already exists), sets its password and grants
- * it CONNECT on `postgres`. It revokes nothing from PUBLIC (see the file comment). Roles are made by
+ * The job's script: makes the role (idempotent, kept if it already exists), sets its password, closes
+ * `postgres` and `template1` to PUBLIC and grants the role CONNECT on `postgres` (see the file comment). Roles are made by
  * `format('%I')` and the password by `format('%L')`, so no value is spliced into SQL by the shell. Setting
  * the password again is harmless, so a mint that is repeated simply replaces it. It never prints a URL or a password: psql's output is discarded and the one
  * error line names neither.
@@ -67,11 +89,8 @@ export interface OrgAppsAdminDeps {
     coolify: AppsAdminCoolify;
     ensureProject(): Promise<string>;
     serverUuid(): Promise<string>;
-    /** Starts the company's Postgres server when it is not running and returns its live record. */
-    startDatabase(uuid: string): Promise<{
-        internal_db_url?: string;
-        status?: string;
-    }>;
+    /** The apps database's superuser address (`appsDbAdminUrl`): its internal host, TLS asked for. A secret. */
+    appsDbAdminUrl(appId: string): Promise<string>;
     deliverSecret(ref: string, secret: string): Promise<void>;
     /** Registers a value for redaction. */
     onSecret?(value: string): void;
@@ -92,6 +111,11 @@ export interface OrgAppsAdminDeps {
 export declare function provisionOrgAppsAdmin(scope: StepScope, deps: OrgAppsAdminDeps, org: DeclaredOrg): Promise<void>;
 /** What the retire form takes from the executor: the mint form's deps, and the held-key blanking. */
 export interface RetireOrgAppsAdminDeps extends Omit<OrgAppsAdminDeps, 'deliverSecret'> {
+    /** Starts the old `<slug>-postgres` server when it is not running and returns its live record (a role made there by an earlier version). */
+    startDatabase(uuid: string): Promise<{
+        internal_db_url?: string;
+        status?: string;
+    }>;
     /** Blanks the held URL (the store has no delete: an empty value reads as not held). */
     clearHeldUrl(ref: string): Promise<void>;
     /** Takes `APPS_DATABASE_ADMIN_URL` out of Boule's env. A row already gone is not an error. */

package/dist/plan/org-apps-admin.js

@@ -1,25 +1,32 @@
 import { randomBytes } from 'node:crypto';
 import { pinnedRef } from '../bootstrap/versions.js';
 import { ORG_POSTGRES_SERVER_SCOPE_KEY, appsOn } from '../org.js';
+import { APPS_DB_SCOPE_KEYS, appsDbName, appsDbRecorded } from './apps-db.js';
 import { JobFailure, waitForJob } from './job-app.js';
-import { orgPostgresServerName } from './org-postgres.js';
 import { boundedCall, withCallTimeout } from './signin-db.js';
 /**
- * estate#210: a narrow role on the company's one Postgres server (`org-postgres.ts`) that Boule uses
+ * estate#210: a narrow role on the company's apps database (`apps-db.ts`, `<slug>-apps-db`, foundry's own
+ * TLS Postgres: Hyperdrive refuses an origin without TLS) that Boule uses
  * to create a database per app copy itself -- `LOGIN CREATEDB CREATEROLE` only, never superuser,
  * never able to touch another role's data or database (estate#215, tested on Postgres 16.15). Its
  * connection URL is the one credential Boule is handed; it never sees the server's own admin URL.
  *
- * This step does NOT touch CONNECT on any database. `org-postgres-job.ts` deliberately leaves CONNECT open
- * on PUBLIC (a template app creates its own runtime role on first boot and relies on it), so a server-wide
- * `REVOKE CONNECT ... FROM PUBLIC` here would lock out every existing home. Isolation between app databases
- * is done by Boule instead (contract with the Boule builder): on each `app_*` database it creates, Boule
- * revokes CONNECT from PUBLIC and grants it to that database's own role only. The admin role holds CONNECT
- * on `postgres` alone.
+ * CONNECT: the apps database is foundry's own server with no home on it that relies on PUBLIC's CONNECT
+ * (unlike `<slug>-postgres`, see `org-postgres-job.ts`), so the mint job revokes CONNECT on `postgres` and
+ * `template1` from PUBLIC and grants it to the admin role on `postgres` (the database its URL names). It
+ * touches no other database. Isolation between app databases is done by Boule (contract with the Boule
+ * builder): on each `app_*` database it creates, Boule revokes CONNECT from PUBLIC and grants it to that
+ * database's own role only; until it does, a new database has PUBLIC's default CONNECT, which no setting on
+ * this server can change.
  *
  * Wired by F4 (#925): the step is planned only for a company whose Boule runs apps (`appsOn`,
- * `org.boule.apps`), after the company's Postgres server and Boule are recorded or planned. The URL is
- * held at {@link appsAdminUrlRef} and written to Boule's env as `APPS_DATABASE_ADMIN_URL`. Turning apps
+ * `org.boule.apps`), after the company's apps database and Boule are recorded or planned. The URL is
+ * held at {@link appsAdminUrlRef} and written to Boule's env as `APPS_DATABASE_ADMIN_URL`, with
+ * `?sslmode=require`: the server accepts TLS connections only and the encryption needs no CA file.
+ * The recorded {@link ORG_APPS_ADMIN_SCOPE_KEY} names the server the role is on. A company that made its
+ * role on the old `<slug>-postgres` server (an earlier version) has that name recorded, so the step is
+ * planned again and makes the role on the apps database; the old role and everything on the old server are
+ * left as they are. Turning apps
  * off plans the retire form ({@link retireOrgAppsAdmin}): the env row goes, the held URL is blanked, and
  * the role is set NOLOGIN and its sessions ended. Nothing is dropped: the role, the `app_*` databases
  * and their roles stay, so turning apps on again mints a new password for the same role.
@@ -34,11 +41,24 @@ function checked(name) {
 export const appsAdminRoleName = (org) => `${org.slug}_apps_admin`;
 /** The job app's name in Coolify. */
 export const appsAdminJobName = (org) => `${org.slug}-apps-admin-job`;
-/** Recorded once the role is made, its password set, and the URL delivered. */
+/** Recorded once the role is made, its password set, and the URL delivered: {@link appsAdminDoneValue}, or the old server's name. */
 export const ORG_APPS_ADMIN_SCOPE_KEY = 'org_apps_admin';
+/**
+ * What {@link ORG_APPS_ADMIN_SCOPE_KEY} holds when the role is on the apps database and the job that made it
+ * also closed `postgres` and `template1` to PUBLIC. A company recorded with the bare server name (a version
+ * before the revokes) is planned once more, which runs the whole idempotent job again.
+ */
+export const appsAdminDoneValue = (org) => `${appsDbName(org)}:closed`;
+/**
+ * Set to the server's name when a mint job failed, while the role may have been made there. Not a note that
+ * blocks anything: it only makes turning apps off retire the role on the apps database, so a role that
+ * {@link ORG_APPS_ADMIN_SCOPE_KEY} never recorded is not left able to log in.
+ */
+export const ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY = 'org_apps_admin_touched';
 /**
  * An opaque id, set once the password is minted and the job that sets it is about to run, until the URL is
- * delivered. Never the password. A failure before that point leaves no id, so the next apply tries again.
+ * delivered. Never the password. A failure before that point leaves no id, and a job that fails clears it (the
+ * mint is idempotent and delivered nothing), so the next apply tries again.
  */
 export const ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY = 'org_apps_admin_undelivered';
 /** The job app's id while it exists. */
@@ -54,12 +74,13 @@ export const ORG_APPS_ADMIN_DELIVERY_ATTEMPTS = 3;
  * recorded id once the role is confirmed gone from the server.
  */
 export function planOrgAppsAdminStep(org, recordedIds, options = {}) {
-    if (recordedIds[ORG_APPS_ADMIN_SCOPE_KEY])
+    if (recordedIds[ORG_APPS_ADMIN_SCOPE_KEY] === appsAdminDoneValue(org)) {
         return { step: null, blocked: null };
-    if (!recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY]) {
+    }
+    if (!appsDbRecorded(recordedIds)) {
         return {
             step: null,
-            blocked: `${org.slug}'s apps admin role is blocked, not planned: its Postgres server is not provisioned yet`,
+            blocked: `${org.slug}'s apps admin role is blocked, not planned: its apps database is not provisioned yet`,
         };
     }
     const lost = recordedIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY];
@@ -87,9 +108,27 @@ export function planOrgAppsAdminStep(org, recordedIds, options = {}) {
         blocked: null,
     };
 }
+/**
+ * The servers a retire has to reach: the apps database when the role is recorded on it (or a mint is
+ * pending, which only ever runs against it), and the old `<slug>-postgres` server when the role was made
+ * there by an earlier version (or a mint of that version was never delivered, which could be on either).
+ */
+export function appsAdminRetireTargets(org, recorded) {
+    const role = recorded[ORG_APPS_ADMIN_SCOPE_KEY];
+    const pending = Boolean(recorded[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY]);
+    const onAppsDb = Boolean(role?.startsWith(appsDbName(org)));
+    return {
+        legacy: (Boolean(role) && !onAppsDb) ||
+            (pending && !role && Boolean(recorded[ORG_POSTGRES_SERVER_SCOPE_KEY])),
+        // A failed mint may have made the role there. Retiring a role that is not there is a no-op (the script guards with EXISTS).
+        current: onAppsDb ||
+            (Boolean(recorded[APPS_DB_SCOPE_KEYS.app]) &&
+                (pending || Boolean(recorded[ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY]))),
+    };
+}
 /**
  * Pure. F4 (#925): the wiring of {@link planOrgAppsAdminStep} to `org.boule.apps`. Apps on: the mint
- * step, once Boule (which receives the URL) and the Postgres server are recorded or planned. Apps off with
+ * step, once Boule (which receives the URL) and the apps database are recorded or planned. Apps off with
  * the role recorded (or a mint never delivered): the retire step, which needs no secret and drops nothing.
  */
 export function planAppsAdmin(org, recordedIds, plannedSteps, options) {
@@ -97,12 +136,15 @@ export function planAppsAdmin(org, recordedIds, plannedSteps, options) {
     const blocked = [];
     if (!appsOn(org)) {
         if (!recordedIds[ORG_APPS_ADMIN_SCOPE_KEY] &&
-            !recordedIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY]) {
+            !recordedIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY] &&
+            !recordedIds[ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY]) {
             return { steps: [], blocked };
         }
-        if (!recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY]) {
+        const targets = appsAdminRetireTargets(org, recordedIds);
+        if ((targets.legacy && !recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY]) ||
+            (targets.current && !recordedIds[APPS_DB_SCOPE_KEYS.app])) {
             blocked.push({
-                description: `${org.slug}'s apps admin role is not retired, not planned: its Postgres server is not recorded`,
+                description: `${org.slug}'s apps admin role is not retired, not planned: the server it is on is not recorded`,
                 key,
             });
             return { steps: [], blocked };
@@ -128,15 +170,15 @@ export function planAppsAdmin(org, recordedIds, plannedSteps, options) {
     }
     const bouleReady = Boolean(recordedIds[`coolify:boule:${org.id}`]) ||
         plannedSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'boule' && p.action.key === org.id);
-    if (!bouleReady && !recordedIds[ORG_APPS_ADMIN_SCOPE_KEY]) {
+    if (!bouleReady && recordedIds[ORG_APPS_ADMIN_SCOPE_KEY] !== appsAdminDoneValue(org)) {
         blocked.push({
             description: `${org.slug}'s apps admin role is blocked, not planned: Boule is not recorded yet`,
             key,
         });
         return { steps: [], blocked };
     }
-    const seen = options.postgresPlanned && !recordedIds[ORG_POSTGRES_SERVER_SCOPE_KEY]
-        ? { ...recordedIds, [ORG_POSTGRES_SERVER_SCOPE_KEY]: 'planned' }
+    const seen = options.appsDbPlanned && !appsDbRecorded(recordedIds)
+        ? { ...recordedIds, [APPS_DB_SCOPE_KEYS.app]: 'planned', [APPS_DB_SCOPE_KEYS.tls]: 'planned' }
         : recordedIds;
     const planned = planOrgAppsAdminStep(org, seen, { canHoldSecrets: options.canHoldSecrets });
     if (planned.blocked)
@@ -144,8 +186,8 @@ export function planAppsAdmin(org, recordedIds, plannedSteps, options) {
     return { steps: planned.step ? [planned.step] : [], blocked };
 }
 /**
- * The job's script: makes the role (idempotent, kept if it already exists), sets its password and grants
- * it CONNECT on `postgres`. It revokes nothing from PUBLIC (see the file comment). Roles are made by
+ * The job's script: makes the role (idempotent, kept if it already exists), sets its password, closes
+ * `postgres` and `template1` to PUBLIC and grants the role CONNECT on `postgres` (see the file comment). Roles are made by
  * `format('%I')` and the password by `format('%L')`, so no value is spliced into SQL by the shell. Setting
  * the password again is harmless, so a mint that is repeated simply replaces it. It never prints a URL or a password: psql's output is discarded and the one
  * error line names neither.
@@ -170,6 +212,9 @@ export function orgAppsAdminScript(role, mode = 'mint') {
         '\\getenv pw PW',
         "SELECT format('CREATE ROLE %I LOGIN CREATEDB CREATEROLE', :'role') WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'role') \\gexec",
         "SELECT format('ALTER ROLE %I LOGIN CREATEDB CREATEROLE PASSWORD %L', :'role', :'pw') \\gexec",
+        // The apps database's own `postgres` and `template1` are closed to every app role; Boule closes each app database it makes.
+        'REVOKE CONNECT ON DATABASE postgres FROM PUBLIC;',
+        'REVOKE CONNECT ON DATABASE template1 FROM PUBLIC;',
         "SELECT format('GRANT CONNECT ON DATABASE postgres TO %I', :'role') \\gexec",
         'SQL',
         'echo "org-apps-admin: role ready"',
@@ -226,26 +271,25 @@ export async function provisionOrgAppsAdmin(scope, deps, org) {
     const label = `${org.slug}'s apps admin role`;
     const coolify = withCallTimeout(deps.coolify);
     const recorded = scope.recordedIds();
-    if (recorded[ORG_APPS_ADMIN_SCOPE_KEY])
+    if (recorded[ORG_APPS_ADMIN_SCOPE_KEY] === appsAdminDoneValue(org))
         return;
-    const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
-    if (!serverId)
-        throw new Error(`${label}: the Postgres server is not recorded yet`);
+    const serverId = recorded[APPS_DB_SCOPE_KEYS.app];
+    if (!serverId || !recorded[APPS_DB_SCOPE_KEYS.tls]) {
+        throw new Error(`${label}: the apps database is not recorded yet`);
+    }
     if (recorded[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY]) {
         throw new Error(`${label}: an earlier run set a new password on the role but never saved its connection URL. Nothing is lost. To start over, turn apps off and apply (that retires the role and clears this note), then turn apps on again`);
     }
     const onSecret = (value) => deps.onSecret?.(value);
-    const server = await boundedCall(deps.startDatabase(serverId), 'Coolify startDatabase');
-    if (!server.internal_db_url || !URL.canParse(server.internal_db_url)) {
-        throw new Error(`${label}: the Postgres server has no usable internal URL`);
-    }
-    const adminUrl = server.internal_db_url;
+    const adminUrl = await boundedCall(deps.appsDbAdminUrl(serverId), 'read the apps database address');
     onSecret(adminUrl);
+    if (!URL.canParse(adminUrl))
+        throw new Error(`${label}: the apps database has no usable address`);
     const adminParsed = new URL(adminUrl);
     const host = adminParsed.hostname;
     const port = adminParsed.port || '5432';
     if (!host)
-        throw new Error(`${label}: the Postgres server's internal URL has no host`);
+        throw new Error(`${label}: the apps database's address has no host`);
     const adminPassword = decodeURIComponent(adminParsed.password);
     if (adminPassword)
         onSecret(adminPassword);
@@ -312,6 +356,12 @@ export async function provisionOrgAppsAdmin(scope, deps, org) {
                     '; its env could not be cleared, delete the app in Coolify (it holds the admin URL)';
             }
         }
+        // The job is idempotent (the role is made only if missing, the password is set again), and a failed run
+        // delivered nothing, so a plan that mints again loses nothing: the marker is cleared and the next apply repeats.
+        scope.recordScopeId(ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY, '');
+        // The role may exist by now (the job can fail after CREATE ROLE): apps off must retire it there.
+        scope.recordScopeId(ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY, appsDbName(org));
+        await scope.persist();
         throw new Error(`${label}: ${why}${jobAppId ? `; the job app ${jobAppId} is left stopped without secrets for inspection and the next apply replaces it${cleaned}` : ''}; apply again`);
     }
     try {
@@ -320,7 +370,7 @@ export async function provisionOrgAppsAdmin(scope, deps, org) {
     catch {
         throw new Error(`${label}: the role was made, but its job app ${jobAppId} could not be deleted; delete it in Coolify (it holds the admin URL), then apply again`);
     }
-    const url = `postgres://${encodeURIComponent(role)}:${encodeURIComponent(password)}@${host}:${port}/postgres`;
+    const url = `postgres://${encodeURIComponent(role)}:${encodeURIComponent(password)}@${host}:${port}/postgres?sslmode=require`;
     onSecret(url);
     let delivered = false;
     for (let attempt = 1; attempt <= ORG_APPS_ADMIN_DELIVERY_ATTEMPTS && !delivered; attempt++) {
@@ -335,8 +385,9 @@ export async function provisionOrgAppsAdmin(scope, deps, org) {
     if (!delivered) {
         throw new Error(`${label}: the role was made, but its connection URL could not be saved after ${ORG_APPS_ADMIN_DELIVERY_ATTEMPTS} attempts. Nothing is lost. Turn apps off and apply (that retires the role and clears the note), then turn apps on again`);
     }
-    scope.recordScopeId(ORG_APPS_ADMIN_SCOPE_KEY, orgPostgresServerName(org));
+    scope.recordScopeId(ORG_APPS_ADMIN_SCOPE_KEY, appsAdminDoneValue(org));
     scope.recordScopeId(ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY, '');
+    scope.recordScopeId(ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY, '');
     await scope.persist();
     scope.recordScopeId(ORG_APPS_ADMIN_JOB_APP_SCOPE_KEY, '');
 }
@@ -351,20 +402,15 @@ export async function retireOrgAppsAdmin(scope, deps, org) {
     const label = `${org.slug}'s apps admin role`;
     const coolify = withCallTimeout(deps.coolify);
     const recorded = scope.recordedIds();
-    const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
-    const hadRole = Boolean(recorded[ORG_APPS_ADMIN_SCOPE_KEY] || recorded[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY]);
-    if (hadRole) {
-        if (!serverId)
-            throw new Error(`${label}: the Postgres server is not recorded; cannot retire it`);
-        const onSecret = (value) => deps.onSecret?.(value);
-        const server = await boundedCall(deps.startDatabase(serverId), 'Coolify startDatabase');
-        if (!server.internal_db_url || !URL.canParse(server.internal_db_url)) {
-            throw new Error(`${label}: the Postgres server has no usable internal URL`);
+    const onSecret = (value) => deps.onSecret?.(value);
+    /** Runs the retire job against the server `adminUrl` names. */
+    const retireOn = async (adminUrl) => {
+        onSecret(adminUrl);
+        if (URL.canParse(adminUrl)) {
+            const password = decodeURIComponent(new URL(adminUrl).password);
+            if (password)
+                onSecret(password);
         }
-        onSecret(server.internal_db_url);
-        const password = decodeURIComponent(new URL(server.internal_db_url).password);
-        if (password)
-            onSecret(password);
         const jobName = appsAdminJobName(org);
         let jobAppId;
         try {
@@ -390,9 +436,7 @@ export async function retireOrgAppsAdmin(scope, deps, org) {
             scope.recordScopeId(ORG_APPS_ADMIN_JOB_APP_SCOPE_KEY, jobAppId);
             await scope.persist();
             await coolify.updateApplication(jobAppId, { health_check_enabled: false });
-            await coolify.bulkUpsertEnvs(jobAppId, [
-                { key: 'ADMIN_DATABASE_URL', value: server.internal_db_url },
-            ]);
+            await coolify.bulkUpsertEnvs(jobAppId, [{ key: 'ADMIN_DATABASE_URL', value: adminUrl }]);
             await coolify.deploy(jobAppId, true);
             await waitForJob(coolify, jobAppId, deps.runtime ?? {}, {
                 job: 'the apps admin retire job',
@@ -420,12 +464,31 @@ export async function retireOrgAppsAdmin(scope, deps, org) {
         catch {
             throw new Error(`${label}: the role was retired, but its job app ${jobAppId} could not be deleted; delete it in Coolify (it holds the admin URL), then apply again`);
         }
+    };
+    const targets = appsAdminRetireTargets(org, recorded);
+    if (targets.legacy) {
+        const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
+        if (!serverId) {
+            throw new Error(`${label}: the Postgres server is not recorded; cannot retire it`);
+        }
+        const server = await boundedCall(deps.startDatabase(serverId), 'Coolify startDatabase');
+        if (!server.internal_db_url || !URL.canParse(server.internal_db_url)) {
+            throw new Error(`${label}: the Postgres server has no usable internal URL`);
+        }
+        await retireOn(server.internal_db_url);
+    }
+    if (targets.current) {
+        const appId = recorded[APPS_DB_SCOPE_KEYS.app];
+        if (!appId)
+            throw new Error(`${label}: the apps database is not recorded; cannot retire it`);
+        await retireOn(await boundedCall(deps.appsDbAdminUrl(appId), 'read the apps database address'));
     }
     await deps.removeBouleEnv();
     await deps.clearHeldUrl(appsAdminUrlRef(org));
     for (const key of [
         ORG_APPS_ADMIN_SCOPE_KEY,
         ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY,
+        ORG_APPS_ADMIN_TOUCHED_SCOPE_KEY,
         ORG_APPS_ADMIN_JOB_APP_SCOPE_KEY,
     ]) {
         scope.recordScopeId(key, '');

package/dist/plan/plan-apply.js

@@ -2645,6 +2645,7 @@ const STEP_FIELDS = {
     'coolify:own-auth': 'services.own',
     'coolify:own-auth-db-move': 'services.own',
     'coolify:worker-app-db': 'hosting.entries.workerApp.database',
+    'coolify:apps-db': 'boule.apps',
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',

package/dist/plan/signin-db-backup.d.ts

@@ -88,6 +88,7 @@ export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: s
     user: string;
     database: string;
     prefixBase?: string;
+    dumpAll?: boolean;
 }): Array<{
     key: string;
     value: string;
@@ -98,8 +99,11 @@ export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: s
  * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
  * run non-zero, and curl's error text names the HTTP status only. It lives in the app's env, base64,
  * because Coolify stores a task's command in 255 characters and this script is longer.
+ *
+ * `all` dumps the whole server with `pg_dumpall` (plain SQL, roles included) instead of one database in
+ * custom format: the company's apps server holds a database per app copy and none worth dumping in `postgres`.
  */
-export declare function signinDbBackupScript(user: string, database: string): string;
+export declare function signinDbBackupScript(user: string, database: string, all?: boolean): string;
 /** The most Coolify stores in a scheduled task's command (`varchar(255)`); a longer one answers 500. */
 export declare const COOLIFY_TASK_COMMAND_MAX = 255;
 /**

package/dist/plan/signin-db-backup.js

@@ -129,7 +129,7 @@ export function signinDbBackupEnvs(target, slug, db) {
         { key: SIGNIN_DB_BACKUP_ENV.prefix, value: signinDbBackupPrefix(slug, db.prefixBase) },
         {
             key: SIGNIN_DB_BACKUP_ENV.script,
-            value: Buffer.from(signinDbBackupScript(db.user, db.database), 'utf8').toString('base64'),
+            value: Buffer.from(signinDbBackupScript(db.user, db.database, db.dumpAll === true), 'utf8').toString('base64'),
         },
     ];
 }
@@ -139,14 +139,17 @@ export function signinDbBackupEnvs(target, slug, db) {
  * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
  * run non-zero, and curl's error text names the HTTP status only. It lives in the app's env, base64,
  * because Coolify stores a task's command in 255 characters and this script is longer.
+ *
+ * `all` dumps the whole server with `pg_dumpall` (plain SQL, roles included) instead of one database in
+ * custom format: the company's apps server holds a database per app copy and none worth dumping in `postgres`.
  */
-export function signinDbBackupScript(user, database) {
+export function signinDbBackupScript(user, database, all = false) {
     const e = SIGNIN_DB_BACKUP_ENV;
     return [
         'set -eu',
-        'f=/tmp/signin-db-$(date -u +%Y%m%dT%H%M%SZ).dump',
+        `f=/tmp/signin-db-$(date -u +%Y%m%dT%H%M%SZ).${all ? 'sql' : 'dump'}`,
         'trap "rm -f $f" EXIT',
-        `pg_dump -U ${user} -d ${database} -Fc -f "$f"`,
+        all ? `pg_dumpall -U ${user} -f "$f"` : `pg_dump -U ${user} -d ${database} -Fc -f "$f"`,
         `printf "user = \\"%s:%s\\"\\n" "$${e.keyId}" "$${e.secret}" | curl -sS --fail --max-time ${UPLOAD_MAX_SECONDS} --aws-sigv4 "aws:amz:$${e.region}:s3" -K - -T "$f" "$${e.endpoint}/$${e.bucket}/$${e.prefix}/\${f##*/}"`,
     ].join('; ');
 }

package/dist/plan/signin-db.d.ts

@@ -118,6 +118,8 @@ export interface TlsDbOptions {
     scopeKeys?: TlsDbScopeKeys;
     /** The folder in the bucket before the slug (default `signin-db`). */
     backupPrefix?: string;
+    /** The nightly dump takes the whole server (`pg_dumpall`), not `database` alone. */
+    dumpAll?: boolean;
 }
 /**
  * Brings the TLS database up and returns ZITADEL's DSN: the CA and server certificate (held in

package/dist/plan/signin-db.js

@@ -229,6 +229,7 @@ export async function provisionSigninDb(input, options = {}) {
             user,
             database,
             prefixBase: options.backupPrefix,
+            dumpAll: options.dumpAll,
         }),
     ];
     const changed = await envsDiffer(coolify, app.appId, envs);

package/dist/plan/worker-app.d.ts

@@ -239,6 +239,12 @@ export interface WorkerAppPlanInput {
         noDeleteCheck?: boolean;
     };
 }
+/**
+ * The company's apps database route (`apps-db-route.ts`) records its parts under this entry key with
+ * the Worker app database helpers, so {@link liveWorkerApps} lists it. It is not a Worker app: apps
+ * switched off retire it, never the undeclared-Worker-app step.
+ */
+export declare const APPS_DB_ENTRY_KEY = "apps-db";
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
 export declare function liveWorkerApps(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
 /**

package/dist/plan/worker-app.js

@@ -237,6 +237,12 @@ export function migrationPrefixError(applied, declared) {
 }
 /** The unapplied migrations after the last tag in `applied`. */
 export const unappliedMigrations = (declared, applied) => declared.slice(applied.length);
+/**
+ * The company's apps database route (`apps-db-route.ts`) records its parts under this entry key with
+ * the Worker app database helpers, so {@link liveWorkerApps} lists it. It is not a Worker app: apps
+ * switched off retire it, never the undeclared-Worker-app step.
+ */
+export const APPS_DB_ENTRY_KEY = 'apps-db';
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
 export function liveWorkerApps(orgId, recordedIds) {
     const mainPrefix = `cloudflare:worker-app:${orgId}:`;
@@ -291,7 +297,7 @@ export function planWorkerApps(org, recordedIds, input) {
     const blocked = [];
     const declared = new Set(org.hosting.enabled ? org.hosting.entries.filter((e) => e.workerApp).map((e) => e.key) : []);
     for (const entryKey of liveWorkerApps(org.id, recordedIds).keys()) {
-        if (declared.has(entryKey))
+        if (declared.has(entryKey) || entryKey === APPS_DB_ENTRY_KEY)
             continue;
         const key = workerAppResourceKey(`${org.id}:${entryKey}`);
         if (!input.available) {

package/dist/store/postgres.js

@@ -1,5 +1,5 @@
 import { and, asc, desc, eq, gte, inArray, isNull, ne, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, normalizeHostingRepos, refuseBuiltinBlueGreen, refuseCustomers, refuseHosting, validateBlueGreen, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, normalizeHostingRepos, refuseBuiltinBlueGreen, refuseCustomers, refuseHosting, validateBlueGreen, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, withNewOrgAppsDefault, } from '../org.js';
 import { hostingNames } from '../plan/locked-hostnames.js';
 import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
@@ -486,7 +486,10 @@ export function createPostgresDeclaredOrgStore(db) {
     }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
-        async create(org) {
+        async create(given) {
+            // #1041: fills `boule.apps` in only while the caller declares no `boule` of its own -- never on
+            // `update`, so an existing company's stored value (on or off) is read back exactly as it is.
+            const org = withNewOrgAppsDefault(given);
             requireValidSlug(org.slug);
             requireValidDomain(org.domain);
             requireValidLimits(org);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.68.0",
+  "version": "0.68.2",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",